keystone-engine / keystone

Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
http://www.keystone-engine.org
GNU General Public License v2.0
2.3k stars 456 forks source link

Inline comments inside assembly code string | python #572

Closed C0llect0r closed 10 months ago

C0llect0r commented 11 months ago

Hey there,

i'm currently using the keystone engine under python to implement a reverse shell for windows and i was curious if you can add comments into the assembler code itself. Maybe this is a stupid question, but i didn't see any reference if this is possible or not.

What i know is possible (formatting sucks, but in the editor it was clean.):

CODE: str = (
"start:                                                                              "
"    int3;                                                                           "
"    mov ebp, esp;                                                             "
"    add esp, 0xFFFFFDF0;                                                 "
"                                                                                      "
"find_kernel32:                                                                 "
"    xor ecx, ecx;                                                                 "
"    mov esi, fs:[ecx + {PEB_OFFSET}];                                 " # get the peb from the teb.
"    mov esi, [esi + {PEB_LDR_DATA_OFFSET}];                    "  # get the ldr data structure from the peb.
"    mov esi, [esi + {INIT_ORDER_MODULE_LIST_OFFSET}]; " # get the list of loaded modules in initialization order.
)

What i try to achieve (comments start with #):

CODE: str = f"""
    start:
        int3;

        mov ebp, esp;
        add esp, 0xFFFFFDF0;

    find_kernel32:
        xor ecx, ecx;

        # get the peb from the teb.
        mov esi, fs:[ecx + {PEB_OFFSET}]; 

        # get the ldr data structure from the peb.
        mov esi, [esi + {PEB_LDR_DATA_OFFSET}];

        # get the list of loaded modules in initialization order. 
        mov esi, [esi + {INIT_ORDER_MODULE_LIST_OFFSET}];
"""

The first version is ugly as hell and you have to format everything manually which is kinda annoying.

C0llect0r commented 10 months ago

Late reply, but i tested this the same day with my code and it works just as my example depicts.